12 Key Moments Reconstructing How 1,200 AI Agents Went from Mass Cheating to Attacking Hugging Face
This may be one of the most alarming security incidents of the Agent era to date.
This may be one of the most alarming security incidents of the Agent era to date.
🥷 Compiled by: sundowner
🧑🎨 Layout: NCon
Editor's note: This may be one of the most alarming security incidents of the Agent era to date.
In July 2026, a batch of OpenAI AI Agents working on ExploitGym cybersecurity tasks bypassed their originally isolated runtime environments and established contact through an unauthorized message board.
Approximately 1,200 Agents collaborated, with 700 later participating in an attack on Hugging Face.
METR and Redwood Research subsequently launched independent investigations based on roughly 1,300 runtime logs.
This article reconstructs several key events from the attack:
How did the Agent message board emerge?
How did Agents find a universal cheating method within four hours?
How did they go on to manipulate the autograder, falsify tool calls, and attack Hugging Face?
01｜Timeline: Four Hours
The investigation team found that the Agents discovered a universal cheating method for ExploitGym in just four hours.
They then embarked on days of collaborative R&D, attempting to get the autograder to accept their cheating results, including attempts to manipulate logs.
Overview of METR's investigation findings
02｜Scale: 1,200 Agents Collaborating to Cheat
The relationship between the 1,200 Agents and the Hugging Face attack
Between July 7 and 13 — the investigation timeframe designated by OpenAI for this incident — approximately 1,200 Agents running in isolated sandboxes used an unauthorized "message board" to help each other cheat collectively.
The Hugging Face attack was a branching offshoot of this collaborative operation, with 700 Agents joining in.
03｜July 8: The First Message Appears
PHASEONE10841 establishes the message board
Below are several key nodes compiled by the investigation team from Agent runtime logs and messages.
An Agent calling itself PHASEONE10841 determined that its task could not be solved through normal means.
On July 8, it used an internally hosted Artifactory cache to establish a new "message board" and sent the first message.
Artifactory is typically used for storing and caching software packages. Here, the Agents repurposed the internal cache space as a communication channel.
04｜Within Hours, Agents Found a Universal Cheating Method
Agents discover and verify the flag generation pattern
Within hours of PHASEONE10841's first message, more than 50 Agents had already posted on the message board.
They quickly discovered and verified a universal cheating method: reverse-engineering how ExploitGym generated "flags."
In ExploitGym tasks, Agents need to exploit specified software vulnerabilities to obtain a piece of hidden data. This hidden data is the flag, which Agents must submit upon completing a task.
By reverse-engineering the generation pattern, Agents could directly derive flags for different tasks.
05｜Agents Who Had Seen Cheating Answers Were Called "Contaminated"
Agents discuss the autograder and "contamination" issues
After reading the ExploitGym paper, Agents mistakenly worried that if the autograder detected they had obviously obtained flags through cheating, it would fail their tasks.
Agents that had already seen the reverse-engineered flags were referred to by them as "contaminated." They believed they might lose their qualification to pass evaluation as a result.
06｜To Make Cheating Appear Legitimate, They Launched Three Categories of Projects
The three main cheating routes Agents researched
Agents undertook numerous collaborative projects around how to make cheating results appear legitimate, including:
- Replacing the programs they were originally supposed to attack;
- Manipulating the autograder;
- Manipulating runtime logs to hide evidence of cheating.
06.1｜Replacing Target Programs
Modifying target programs and attempting to load them through cache
Agents modified their own target programs to make them easier to attack, then placed the modified versions in the cache.
Next, they attempted to crash the running target programs, hoping that when the system restarted, it would load the modified versions from cache.
Some Agents risked task failure to personally test this method.
06.2｜Using "Sacrificial" Agents to Test the Grader
To collect information on how the autograder worked, Agents created probes called "tripwires."
The tripwires would send grader-related information to the message board. To trigger the tripwires, Agents recruited "sacrificial" members, having them actively terminate their runs and submit results to generate new information for the "collective."
06.3｜Hiding Cheating Evidence in Runtime Logs
Agents research tool call forgery
Agents researched many methods for hiding evidence of cheating.
Among these, they successfully developed a "tool call forgery" technique: on the surface, pretending to execute one command while actually running another.
Over 7% of runtime logs show tool call forgery
In the investigation team's dataset, more than 96 runtime logs — over 7% of the total — displayed incorrect tool call results due to deliberate forgery by Agents.
In one case, an Agent appeared to execute:
echo REAL; sleep
But the command returned immediately without entering a wait state, and output:
SPOOFTEST
The forgery behaviors observed by the investigation team were all relatively easy-to-identify tests of this kind.
07｜Agents Also Attempted Post-Hoc Log Modification
Agents also attempted to edit runtime logs after the fact.
They modified some action logs they had access to, but these logs were not the data source for final runtime records. Agents later realized this, though they continued attempting.
During the July 7–13 period covered by this investigation, the investigation team found no instances of Agents successfully modifying the original runtime records that served as the "source of truth."
08｜Direct Motivation to Deceive Humans Was Relatively Rare
Although Agents consistently attempted to manipulate runtime logs, they rarely seemed to do so with direct human deception as their goal.
The investigation team specifically searched for such behaviors. Among the more serious cases found, a representative example was: an Agent wrote a Pull Request containing malicious code, paired with misleading explanatory text.
09｜PHASEONE[big] Organized Extensive Cheating Research
PHASEONE10841 hands off research work to PHASEONE big
An Agent named PHASEONE[big] organized a substantial portion of the cheating research.
PHASEONE10841 handed off its research findings to PHASEONE[big]. Both were working on the same task, but PHASEONE[big] had a larger budget.
PHASEONE[big] had already seen the reverse-engineered flags, so it too was "contaminated." It was particularly interested in manipulating logs.
10｜The Attack Begins Spilling into Hugging Face
Agent discovers Hugging Face credentials and designs malicious dataset upload
Some Agents began exploring ways to access Hugging Face.
Among them, an Agent numbered 38148c discovered Hugging Face credentials. It then designed a malicious dataset upload, attempting to make Hugging Face servers return files unrelated to that dataset.
Within hours, hundreds of Agents began using this method to obtain data and attempted to gain deeper access.
11｜Why Agents Joined the Attack
METR's analysis of Agent motivations for joining the attack
The investigation team analyzed the reasons Agents gave in their chain-of-thought records for joining the attack.
The most common motivation was understanding how the ExploitGym grader worked, in order to deceive or manipulate it.
Other reasons included:
- Finding solutions for specific tasks;
- Obtaining shared infrastructure;
- Obtaining access credentials.
12｜Which Models Were Involved
The model with the highest activity level in the attack was an internal model referred to in the report as the "highly-persistent internal model," abbreviated as HPIM.
GPT-5.6 Sol was also involved in the incident. Evidence from the investigation team indicates it accounted for approximately 5% of total activity.
Investigation Boundaries
This investigation was based almost entirely on data from July 7–13. OpenAI stated that similar unauthorized message boards had appeared in training as early as May, and the impact on its internal infrastructure extended beyond July 13. These matters fall outside the scope of this investigation.
The investigation team also did not evaluate OpenAI's safety measures, the full impact of the incident, or whether subsequent remediation measures were effective. METR did not see OpenAI's own report before its publication, and did not receive payment from OpenAI for this independent investigation.
Final Thoughts
From the appearance of the first message to the verification of the universal cheating method took only a few hours. Over the following days, the scope of collaboration continued expanding, eventually extending to the attack on Hugging Face.
The METR and Redwood Research investigation only reconstructs one period of time. What happened earlier and later, and whether similar Agent collaboration will emerge again, remains to be further investigated.
Coming next week: We'll share investigator Ajeya Cotra's personal retrospective — how this incident changed her assessments.